Hardware module and its application method

Abstract

The embodiments of this specification disclose a hardware module for performing the rearrangement of polynomial coefficients in privacy computing. The hardware module includes: an input port for receiving multiple coefficients in polynomial data, wherein each coefficient has a corresponding index; a configuration port for receiving configured affine transformation parameters, including scaling coefficients and offset parameters; a calculation unit for changing the index of each coefficient to the result of affine transformation of the index using the affine transformation parameters; and an output port for outputting the rearranged multiple coefficients. The hardware module can be reused in different coefficient replacement functions, thereby effectively simplifying the hardware architecture. The embodiments of this specification also provide a method for performing the rearrangement of polynomial coefficients in privacy computing through a hardware platform, which makes full use of the recursive characteristics of the affine transformation itself, decomposing the large-length data affine transformation into multiple small-length data affine transformations, thereby alleviating the resource specification limitations of the hardware platform environment.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer technology, and in particular, to a hardware module and a method for rearranging polynomial coefficients in performing privacy computing through a hardware platform. Background Art

[0002] In the modern digital society, data security and privacy are increasingly valued, which has led to the emergence of an emerging technology called privacy computing. The core of this technology is to directly process and analyze encrypted data, thereby ensuring the security of data utilization without leaking sensitive information. The application scenarios of privacy computing are expanding, covering many fields such as medical health and recommendation services, showing its key position in promoting the process of social digitalization.

[0003] As a key technology in privacy computing, homomorphic encryption allows complex computing tasks to be performed under data encryption while ensuring the accuracy of the calculation results and the privacy security of the data itself. It has been widely used in cloud services, data security exchange, and multi-party information collaborative processing. It is regarded as an important way to strengthen data protection and promote secure computing.

[0004] Currently, the most common fully homomorphic encryption schemes are based on lattice-based cryptographic systems. After the advent of bootstrapping technology, traditional second-generation fully homomorphic schemes (such as BGV, BFV, CKKS, etc.) can support unlimited secret operations of addition, subtraction, and multiplication, and thus can realize polynomial calculations of data in secret. However, for non-polynomial function calculations (such as sigmoid, relu, bit logic operations, etc.), the second-generation fully homomorphic schemes can only be realized by fitting the target function into an approximate high-order polynomial function and then performing homomorphic operations on the fitted polynomial function. However, in order to ensure accuracy, the order of the fitted polynomial will be relatively high, resulting in a rapid consumption of the homomorphic multiplication series, which in turn leads to an increase in the cost of secret state calculations, and an increase in the demand for bootstrapping, which seriously affects the efficiency of fully homomorphic implementation.

[0005] In 2016, Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, Malika Izabachène and others proposed a new homomorphic encryption scheme called TFHE based on the programmable bootstrapping (PBS) method, and further improved it in 2020, marking the gradual maturity of the third-generation fully homomorphic scheme technology. In TFHE, the PBS technology based on secret state lookup table calculation is adopted, which transforms homomorphic calculation from "calculating the corresponding ciphertext" to "finding the corresponding ciphertext", thereby allowing non-polynomial functions to be implemented homomorphically through a more efficient method than high-order fitting.

[0006] In today's context where TFHE technology is relatively mature, the applicant proposes a solution that can effectively simplify the hardware architecture used to implement privacy computing such as TFHE technology. Summary of the invention

[0007] The embodiments of this specification describe a hardware module and a method for rearranging polynomial coefficients in privacy computing through a hardware platform, which can realize the reuse of hardware modules in different coefficient replacement functions, thereby effectively simplifying the overall architecture of the hardware platform.

[0008] According to a first aspect, a hardware module is provided for performing rearrangement of polynomial coefficients in privacy computing. The hardware module includes: an input port for receiving multiple coefficients in polynomial data, wherein each coefficient has a corresponding index; a configuration port for receiving configured affine transformation parameters, including scaling coefficients and offset parameters; a calculation unit for changing the indexes of the coefficients to the results of affine transformation of the indexes using the affine transformation parameters, thereby obtaining multiple rearranged coefficients; and an output port for outputting the multiple rearranged coefficients.

[0009] In some embodiments, the number of the plurality of coefficients is a positive integer power of 2, the scaling factor and the offset parameter are both non-negative integers less than the number, and the scaling factor is an odd number.

[0010] In some embodiments, the affine transformation parameters are determined based on a type of the privacy computation.

[0011] In some embodiments, the affine transformation parameters also include a modulus, and the value of the modulus is the number of the multiple coefficients; wherein the affine transformation includes: scaling the indexes of the coefficients using the scaling coefficient, and then offsetting the result of the scaling using the offset parameter; and performing a modulus operation on the result of the offset processing based on the modulus to obtain a result of the affine transformation.

[0012] In some embodiments, the privacy calculation is an automorphic transformation of a polynomial, the scaling coefficient is a result of taking the automorphic transformation constant modulo the number of the multiple coefficients, and the value of the offset parameter is 0.

[0013] In some embodiments, the privacy calculation is a coefficient extraction of a polynomial, the value of the scaling coefficient is the number of the multiple coefficients minus 1, and the value of the offset parameter is an extraction index.

[0014] In some embodiments, the privacy calculation is multiplication of the first monomial of the polynomial, the scaling coefficient is 1, and the offset parameter is the result of taking the modulo value of the difference obtained by subtracting the power of the monomial from the number of the multiple coefficients.

[0015] According to a second aspect, a method for performing polynomial coefficient rearrangement in privacy computing by a hardware platform is provided, wherein the hardware platform includes a dimension switching module and the hardware module in the first aspect. The method includes:

[0016] Through the dimension switching module, a first conversion is performed on the one-dimensional array formed by the n polynomial coefficients in the polynomial data to obtain a two-dimensional n1*n2 array. For the n2 coefficients corresponding to each row in the n1*n2 array, the hardware module is first called based on the n2 coefficients and the first affine transformation parameter to obtain the rearranged n2 coefficients to form the rearranged n1*n2 array. Through the dimension switching module, a second conversion is performed on the rearranged n1*n2 array to obtain an n2*n1 array. For the n1 coefficients corresponding to each row in the n2*n1 array, the hardware module is secondly called based on the n1 coefficients and the second affine transformation parameter to obtain the rearranged n1 coefficients to form the rearranged n2*n1 array. Through the dimension switching module, a third conversion is performed on the rearranged n2*n1 array to obtain a one-dimensional array as the rearranged n polynomial coefficients.

[0017] In some embodiments, the first conversion includes: the element in the i-th row and j-th column in the n1*n2 array is assigned a value of: the i*n2+j-th element in the one-dimensional array.

[0018] Further, in some specific embodiments, the third conversion is an inverse conversion of the first conversion.

[0019] In some embodiments, the first affine transformation parameter is determined by a control unit in the hardware platform based on the following steps: based on the affine transformation parameters configured for the polynomial data, performing a modulo operation on n1 using the scaling coefficient therein to obtain a first scaling coefficient, and performing an affine transformation on the row number of the current row using the scaling coefficient and the offset parameter therein, and then adjusting according to n1 and n2 to obtain a first offset parameter.

[0020] In some embodiments, the second affine transformation parameters are determined by a control unit in the hardware platform based on the following steps: based on the affine transformation parameters configured for the polynomial data, using the scaling coefficient and offset parameter therein to perform a modulo operation on n2 respectively to obtain a second scaling coefficient and a second offset parameter.

[0021] In some embodiments, the n2 coefficients passed in the first call are each read from the same first address by the n2 memories in the hardware platform, and the rearranged n2 coefficients are each written to the same second address by the n2 memories; wherein, the n1 coefficients passed in the second call are each read from the same third address by the n1 memories in the hardware platform, and the rearranged n1 coefficients are each written to the same fourth address by the n1 memories.

[0022] Further, in some specific embodiments, the first address is the same as the second address, and the third address is the same as the fourth address.

[0023] In some specific embodiments, the first address, the second address, the third address and the fourth address are generated by an address generation unit in the hardware platform.

[0024] On the other hand, in some specific embodiments, the memory in the hardware platform is a read-write dual-port memory.

[0025] In summary, the above-mentioned hardware modules and methods disclosed in the embodiments of this specification can effectively simplify the overall architecture of the hardware platform used to implement privacy computing solutions such as TFHE technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A specific example of the execution result of the affine transformation algorithm disclosed in the embodiments of this specification;

[0028] Figure 2 A schematic diagram of the structure of a hardware module designed for an affine transformation algorithm disclosed in an embodiment of this specification;

[0029] Figure 3 A schematic diagram of configuring affine transformation parameters for different types of privacy computing disclosed in an embodiment of this specification;

[0030] Figure 4 This is an example of using hardware modules to implement polynomial automorphism transformation according to the embodiments of this specification;

[0031] Figure 5 This is an example of using a hardware module to implement coefficient extraction of a polynomial according to an embodiment of this specification;

[0032] Figure 6 This is an example of using a hardware module to implement the multiplication of the first monomial of a polynomial disclosed in the embodiments of this specification;

[0033] Figure 7 The embodiments disclosed in this specification Figure 1 A possible storage format for polynomial data in hardware;

[0034] Figure 8 The embodiment disclosed in this specification is based on Figure 7 Specific examples of group reading and writing;

[0035] Fig. 9 A schematic diagram of the composition structure of the hardware platform disclosed in the embodiments of this specification;

[0036] Fig.10 A schematic flow chart of the steps of a method for rearranging polynomial coefficients in performing privacy computing through a hardware platform disclosed in an embodiment of this specification;

[0037] Fig.11 Shown Figure 1 A specific implementation of the affine transformation example in Algorithm 5. DETAILED DESCRIPTION

[0038] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0039] As mentioned above, the embodiments of this specification propose a solution that can effectively simplify the hardware architecture used to implement privacy computing such as TFHE technology. To help understand, the inventive concept of this solution is first introduced.

[0040] In privacy computing such as TFHE technology, at least three polynomial operations are required, such as polynomial automorphism transformation, coefficient extraction, and first monomial multiplication. The difficulty of these polynomial operations lies in the rearrangement of polynomial coefficients, which is actually the index rearrangement or index permutation of polynomial coefficients. These permutation functions are unrelated to each other in the fully homomorphic solution. If targeted hardware designs are performed separately, several permutation functions will require several different hardware logic units.

[0041] The applicant conducted in-depth research and thinking on the mathematical laws of index rearrangement in the above-mentioned polynomial operations, and proposed that different permutation laws can be uniformly abstracted into affine transformations, and hardware design can be carried out for affine transformations, so that a set of modules with different parameter input configurations can support at least three permutation functions at the same time, thereby reducing the number of required module types through the reuse of hardware modules and effectively simplifying the overall hardware architecture.

[0042] The above is an introduction to the inventive concept of the present invention. Next, in conjunction with the drawings of the specification, the affine transformation algorithm abstracted in the present invention and the hardware modules designed for the affine transformation algorithm and the application of the hardware modules in different replacement functions are introduced.

[0043] 1. Affine transformation algorithm (hereinafter referred to as Algorithm 1)

[0044] First of all, it should be explained that affine transformation is a linear transformation that often appears in the fields of geometry and algebra. In the embodiments of this specification, the index rearrangement of polynomial coefficients can be achieved through the abstracted affine transformation law.

[0045] As you can understand, a polynomial is a mathematical expression consisting of variables and coefficients, where the exponent of the variable is a non-negative integer. A polynomial can have one or more terms, each of which is the product of the coefficient and the power of the variable. The general form of a polynomial is:

[0046] (1)

[0047] It should be noted that unless otherwise specified in the text, the length (or number of terms) of a polynomial is represented by n, where n is a positive integer power of 2, and all polynomial data are located in the polynomial ring R q =Z q / X n +1. In this paper, capital letters such as S, F, and D are used to represent polynomials, and a combination of capital letters and [i] is used to represent a coefficient (or data point) with index i, such as data point S[i]. In addition, the index i of any coefficient among the n coefficients of the polynomial is a natural number between 0 and n-1. For example, the n coefficients in formula (1): , the corresponding n indexes can be: .

[0048] In the embodiment of this specification, the input, output and calculation steps of the affine transformation algorithm are as follows:

[0049] 1) Input: polynomial data S, affine transformation parameters a and b.

[0050] Wherein a and b are both selected from 0, 1, 2, ..., n-1, and a is an odd number, n is the length of S, and n is a positive integer power of 2.

[0051] 2) Output: Affine transformation result polynomial D of S.

[0052] 3) Calculation steps: i from 0 to n-1: D[a*i+b mod n]=S[i]

[0053] Observe the calculation step 3) and we can see that:

[0054] In affine transformation, the affine transformation parameter a is used to scale i, so it can also be called a scaling coefficient, and b is used to offset the result of the scaling process, so it can also be called an offset parameter; in addition, the remainder obtained by taking the modulus operation on the result of the offset process with a modulus of n is the result of the affine transformation: a*i+b mod n.

[0055] Through affine transformation, the index i of the coefficient S[i] is changed to the corresponding affine transformation result a*i+b mod n, or in other words, the coefficient S[i] in S is used as the coefficient D[a*i+b mod n] in D.

[0056] In addition, it can be proved by contradiction that, under the premise that a is an odd number and n is a positive integer power of 2, if i and j are different, then a*i+b mod n and a*j+b mod n must also be different.

[0057] Therefore, the affine transformation algorithm can achieve the index rearrangement of n coefficients, that is, the permutation rearrangement of the mapping relationship between coefficients and indices, thereby obtaining multiple rearranged coefficients.

[0058] Figure 1 A specific example is given where n=16, a=7, b=13, where the 16 coefficients in the illustrated polynomial S are exactly the same as their respective index values. After executing the affine transformation algorithm, the indices of the 16 coefficients are permuted and rearranged, for example, Figure 1 The index of coefficient 0 is changed from 0 to 13, and the index of coefficient 15 is changed from 15 to 6, thus obtaining the polynomial D after the coefficients are rearranged.

[0059] The above introduces the affine transformation algorithm.

[0060] 2. Hardware Modules Designed for Affine Transformation Algorithms

[0061] like Figure 2 As shown, the hardware module includes an input port 21 , a configuration port 22 , a calculation unit 23 and an output port 24 .

[0062] The input port 21 is used to receive multiple coefficients in the polynomial data, wherein each coefficient has a corresponding index. It should be understood that the polynomial data corresponds to the polynomial data S in the above algorithm 1, and the multiple coefficients are S[0] to S[n-1] respectively.

[0063] The configuration port 22 is used to receive the configured affine transformation parameters, including the scaling factor and the offset parameter. It should be understood that the scaling factor a and the offset parameter b in the above algorithm 1 can be referred to.

[0064] The calculation unit 23 is used to change the index of each coefficient to the result of affine transformation of the index using the affine transformation parameter, so as to obtain a plurality of rearranged coefficients. It should be understood that the affine transformation can refer to the introduction of calculation step 3) in Algorithm 1; in addition, the plurality of rearranged coefficients are coefficients D[0] to D[n-1] in the polynomial data D in Algorithm 1.

[0065] The output port 24 is used to output the rearranged multiple coefficients, or to output the polynomial data D in the above algorithm 1.

[0066] The above introduces the hardware module designed for the affine transformation algorithm.

[0067] 3. Application of Hardware Modules in Different Types of Privacy Computing

[0068] The hardware modules, combined with different parameter input configurations, can simultaneously support the rearrangement of polynomial coefficients involved in different types of privacy computing, thereby achieving the reuse of hardware modules and effectively simplifying the overall hardware architecture.

[0069] The following takes the three types of privacy computing involving coefficient rearrangement in fully homomorphic encryption TFHE technology as examples: automorphism transformation of polynomials, coefficient extraction, and first monomial multiplication, to illustrate the application of hardware modules in different types of privacy computing.

[0070] 1. Automorphism transformation of polynomials

[0071] Automorphism transformation is mainly used for the rotation operation of ciphertext in the Ring Learning with Errors (RLWE) problem. This is the main means to change the data points in the corresponding plaintext in the ciphertext state.

[0072] The input, output, and calculation steps of the automorphism transformation algorithm (hereinafter referred to as Algorithm 2) are as follows:

[0073] 1.1) Input: polynomial data F, automorphism transformation constant t.

[0074] Where t is selected from 0, 1, 2, .., 2*n-1, and t is an odd number.

[0075] 1.2) Output: polynomial data G

[0076] The above polynomials F and G satisfy the relationship G(X)=F(X t), this relationship involves the properties of polynomial rings and will not be expanded upon.

[0077] 1.3) Computational steps of the algorithm:

[0078] 1.3.1) Initialize s = 0;

[0079] 1.3.2) Calculate d = t * s mod 2n;

[0080] 1.3.3) If d < n, then G[d] = F[s]; if d >= n, then G[d - n] = q - F[s];

[0081] 1.3.4) Calculate s = s + 1;

[0082] 1.3.5) If s < n, return to step 1.3.2), otherwise end.

[0083] It should be noted that the character q in step 1.3.3) is a parameter of the polynomial ring where the polynomial in the text is located. q - F[s] is the negation of the coefficient F(s) under the modular sense, that is, after taking the negative of F(s), a modulo operation with modulus q is performed, i.e., q - F(s) = -F(s) mod q. For G[d - n] = q - F[s], it can be understood that the index s corresponding to the data point F[s] is changed to d - n, and the value of the data point G[d - n] is updated from F[s] to q - F[s].

[0084] Figure 4 An example of an automorphism transformation with n = 16 and t = 5 is given. It should be understood that the coefficients with relatively small grayscales in the polynomial data G represent copies of the original values in the polynomial data F, and the coefficients with relatively large grayscales represent the negative results of the original values in the polynomial data F under the modular sense.

[0085] The above introduces the automorphism transformation algorithm.

[0086] When implementing the automorphism transformation algorithm using a hardware module, the following configurations need to be made for the affine transformation parameters:

[0087] The scaling coefficient a = t mod n, where t is the automorphism transformation constant in Algorithm 2; the offset parameter b = 0. For this, reference can also be made to Figure 3 .

[0088] To assist in understanding, a simple proof of the equivalence between the affine transformation with parameters a = t mod n and b = 0 and the index rearrangement in the automorphism transformation is given. The proof process is as follows:

[0089] On the one hand, substituting \(a = t\bmod n\) and \(b = 0\) into the calculation steps of Algorithm 1, we can get: \(a*i + b\bmod n=(t\bmod n)*i + 0\bmod n=t*i\bmod n\), and thus we can obtain:

[0090] \(D[t*i\bmod n]=S[i]\ (2)\)

[0091] On the other hand, observing step 1.3.3) in Algorithm 2, we can regard \(G[d - n]=q - F[s]\) as \(G[d - n]=F[s]\). This is because in terms of hardware implementation, \(G[d - n]=q - F[s]\) can be regarded as two sub - steps. One is the index change of the coefficient (from \(s\) to \(d - n\)), and the other is the numerical update of the coefficient after the index change. Further, this scheme only focuses on the index change. In addition, the numerical update only involves overwriting the original address of the coefficient, which is relatively simple in hardware implementation.

[0092] After regarding \(G[d - n]=q - F[s]\) as \(G[d - n]=F[s]\), step 1.3.3) in Algorithm 2 can be simplified to:

[0093] If \(d\lt n\), then \(G[d]=F[s]\); if \(d\geq n\), then \(G[d - n]=F[s]\).

[0094] Combining step 1.3.2) of Algorithm 2 and the properties of modulo operation, we can derive the value of \(d\) as follows: If \(d\lt n\), then \(d = t*s\bmod 2n=t*s\bmod n\); if \(d\geq n\), then \(d = t*s\bmod 2n=n+(t*s\bmod n)\). Thus, step 1.3.3) can be expressed as: If \(d\lt n\), then \(G[t*s\bmod n]=F(s)\); if \(d\geq n\), then \(G[n+(t*s\bmod n)-n]=F(s)\). Finally, it can be simplified to:

[0095] \(G[t*s\bmod n]=F[s]\ (3)\)

[0096] It can be understood that \(i\) in formula (2) and \(s\) in formula (3) are equivalent, so formulas (2) and (3) are equivalent. This means that the affine transformation with parameters configured as \(a = t\bmod n\) and \(b = 0\) is equivalent to the automorphism transformation 2.

[0097] The above introduction shows that by configuring the affine transformation parameters as \(a = t\bmod n\) and \(b = 0\), the coefficient permutation rearrangement in polynomial automorphism transformation can be implemented using hardware modules. Next, the application of affine transformation in polynomial coefficient extraction will be introduced.

[0098] 2. Coefficient Extraction of Polynomials

[0099] The main function of coefficient extraction (or coefficient decimation) is to convert RLWE ciphertext into standard learning with errors (LWE) ciphertext in TFHE for programmable bootstrapping.

[0100] The input, output and calculation steps of the coefficient extraction algorithm (hereinafter referred to as Algorithm 3) are as follows:

[0101] 2.1) Input: polynomial data F, extract index e.

[0102] Where e is selected from 0, 1, 2, .., n-1.

[0103] 2.2) Output: polynomial data H.

[0104] 2.3) Calculation steps of the algorithm:

[0105] 2.3.1) s from 0 to e: H[es]=F(s)

[0106] 2.3.2) s from e+1 to n-1: H[n+es]=qF(s)

[0107] It should be noted that the description of the expression qF(s) in step 2.3.2) can be found in the relevant description of step 1.3.3) in the above-mentioned Algorithm 2, and will not be repeated here.

[0108] Figure 5 An example of coefficient extraction with n=16 and e=6 is given. The coefficient with smaller grayscale in the polynomial data H indicates that it is a copy of the original value in the polynomial data F, and the coefficient with larger grayscale indicates that it is the negative result of the original value in the polynomial data F in the modulo sense.

[0109] The above introduces the coefficient extraction algorithm of the polynomial.

[0110] When using the hardware module to implement the coefficient extraction algorithm, the affine transformation parameters need to be configured as follows:

[0111] The scaling factor a = n-1, the offset parameter b = e, where e is the extraction index in Algorithm 3. For this, see Figure 3 .

[0112] To help understand, a simple proof is given for the equivalence of the affine transformation with parameters a = n-1, b = e and the index rearrangement in coefficient extraction. The proof process is as follows:

[0113] Substituting a = n-1 and b = e into the calculation steps of Algorithm 1, we can obtain: a*i+b mod n =(n-1)*i +emod n = n-i+e mod n. Further, we can deduce the value of n-i+e mod n as follows:

[0114] When 0≤i≤e, n-i+e=n+(ei)≥n, so n-i+e mod n=ei, and then D[ei]=S[i];

[0115] When n-1≤i≤e+1, n-i+e≤n, so n-i+e mod n=n+ei, and then D[n+ei]=S[i].

[0116] From the above derivation results and step 2.3) in Algorithm 3, it can be seen that, without considering the negation operation of F(s) in the modular sense, the affine transformation with parameters a=n-1, b=e is equivalent to the coefficient extraction algorithm.

[0117] The above introduction shows that by configuring the affine transformation parameters as a= n-1, b=e, the coefficient permutation and rearrangement in the polynomial self-coefficient extraction can be realized by using the hardware module. Next, the application of affine transformation in the multiplication of the first monomial is introduced.

[0118] 3. Multiply the first monomial of a polynomial

[0119] The first monomial multiplication is mainly used in the blind rotation stage in the programmable bootstrap to rotate the conversion key according to the specific value in the LWE ciphertext.

[0120] The input, output, and calculation steps of the first monomial multiplication algorithm (hereinafter referred to as Algorithm 4) are as follows:

[0121] 3.1) Input: polynomial data F, monomial power r.

[0122] Where r is selected from 0, 1, 2, .., 2n-1.

[0123] 3.2) Output: polynomial data U.

[0124] The relationship between F and U is: U(X)= X r F(X), this relationship involves the properties of the polynomial ring and is not expanded.

[0125] 3.3) Calculation steps of the algorithm:

[0126] 3.3.1) Calculate v = r mod n;

[0127] 3.3.2) s from 0 to n-1-v: If v is equal to r, then U[s]=F(s+v), otherwise U[s]=qF(s+v);

[0128] 3.3.3) s from nv to n-1: If v is equal to r, then U[s]=qF(s-n+v), otherwise U[s]= F(s-n+v).

[0129] It should be noted that the expression qF(s+v) in step 3.3.2) and the expression qF(s-n+v) in step 3.3.3) are both negation operations in the modulo sense.

[0130] Figure 6 An example of multiplication of the first monomial with n=16 and r=25 is given. The coefficient with a smaller grayscale in the polynomial data U indicates that it is a copy of the original value in the polynomial data F, and the coefficient with a larger grayscale indicates that it is the negative result of the original value in the polynomial data F in the modulo sense.

[0131] The above introduces the algorithm for multiplying the first monomial of a polynomial.

[0132] When using the hardware module to implement the first monomial multiplication, the affine transformation parameters need to be configured as follows:

[0133] Scaling factor a = 1; offset parameter b = nr mod n, or, offset parameter b = n-(r mod n), where r is the power of the monomial in Algorithm 4. For this, see Figure 3 .

[0134] To help understand, a simple proof is given for the equivalence of the affine transformation with parameters a=1, b=n-(r mod n) and the rearrangement of indices in the first monomial multiplication. The proof is as follows:

[0135] Let v = r mod n, so b = n-(r mod n) = nv. Based on this, substituting a = 1, b = nv into the calculation steps in Algorithm 1, we can get: a*i + b mod n = i + nv mod n, so D[i + nv mod n] = S[i]. Further, the following deduction can be made for this equation:

[0136] When 0≤i≤n-1-v, v≤i+v≤n-1, so adding v to the indices on both sides of the equation D[i+nv mod n]= S[i] yields D[i+n mod n]= S[i+v], and since i+n mod n=i, D[i] = S[i+v];

[0137] When nv≤i≤n-1, 0≤i-n+v≤v-1, so adding -n+v to the indices on both sides of the equation D[i+nv mod n]= S[i] yields D[i] = S[i-n+v], which holds.

[0138] Furthermore, the above derivation results can be simplified to:

[0139] i from 0 to n-1-v: D[i] = S[i+v];

[0140] i from nv to n-1: D[i] = S[i-n+v].

[0141] Comparing the simplified derivation results above with steps 3.3.2) and 3.3.3) in Algorithm 4, it can be seen that, without considering the negation operation of F(s+v) and F(s-n+v) in the modular sense, the affine transformation with parameters configured as a=1, b=n-(rmod n) is equivalent to the algorithm of first monomial multiplication.

[0142] The proof of the equivalence between the affine transformation with parameters configured as a=1, b=nr mod n and the mnemonic multiplication is similar to the above proof and will not be repeated here.

[0143] As described above, by configuring the affine transformation parameters as a=1, b=nr mod n, the hardware module can be called to realize the coefficient rearrangement in the multiplication of the first monomial of the polynomial.

[0144] In summary, affine transformation parameters can be adaptively configured for different types of privacy computing, so that coefficient index rearrangement in different types of privacy computing can be achieved by calling hardware modules designed for affine transformation algorithms, thereby achieving the reuse of hardware modules and effectively simplifying the overall hardware architecture.

[0145] According to another embodiment, the applicant considers that in privacy computing such as fully homomorphic encryption, the length of the polynomial data may be very large, for example, it can reach n=2 16 =65536. Therefore, the applicant further proposes that according to the recursive nature of the affine transformation, when the hardware platform has limited resource specifications, it can still transform the "large" affine transformation into multiple "small" affine transformations by decomposition and then implement them step by step, which has good flexibility and versatility. Specifically, please refer to the algorithm shown below.

[0146] 4. Affine transformation algorithm with decomposition idea (hereinafter referred to as Algorithm 5)

[0147] 1. Input: polynomial data S, affine parameters a, b, decomposition parameters n1, n2

[0148] The length of the polynomial data S is n, and n1 and n2 are both positive integer powers of 2, and satisfy n=n1*n2.

[0149] 2. Output: affine transformation result polynomial data D

[0150] 3. Calculation steps:

[0151] In the following, T1, T2, and T3 are all two-dimensional arrays of size n1*n2, or two-dimensional n1*n2 arrays; s1 and t1 are both polynomial data of length n1, and s2 and t2 are both polynomial data of length n2.

[0152] 1) x goes from 0 to n1-1, y goes from 0 to n2-1:

[0153] T1[x][y] = S[x*n2+y]

[0154] 2) y from 0 to n2-1:

[0155] 2.1) Calculate a1 = a mod n1, b1 = floordiv(a*y+b,n2) mod n1.

[0156] Among them, floordiv means rounding down after division, that is, .

[0157] 2.2) x from 0 to n1-1:

[0158] s1[x]=T1[x][y]

[0159] 2.3) Perform an affine transformation on polynomial s1 with parameters n1, a1, b1, and output the result to t1

[0160] 2.4) x from 0 to n1-1:

[0161] T2[x][y]=t1[x]

[0162] 3) x from 0 to n1-1:

[0163] 3.1) Calculate a2 = a mod n2, b2 = b mod n2;

[0164] 3.2) y from 0 to n2-1:

[0165] s2[y]=T2[x][y]

[0166] 3.3) Perform an affine transformation on polynomial s2 with parameters n2, a2, b2, and output the result to t2

[0167] 3.4) y from 0 to n2-1:

[0168] T3[x][y]=t2[y]

[0169] 4) x goes from 0 to n1-1, y goes from 0 to n2-1:

[0170] D[x*n2+y] = T3[x][y]

[0171] Observe the algorithm 5 shown above. Its decomposition idea is to convert the data of length n from one-dimensional data to two-dimensional data of n1*n2, which can be seen in step 1), so that the "large" affine transformation of length n can be realized by n1 "small" affine transformations of length n2 and n2 "small" affine transformations of length n1, which can be seen in steps 2) and 3 respectively. In addition, step 4) is to restore the two-dimensional array to a one-dimensional array format.

[0172] In addition, Algorithm 5 only gives the case of decomposing n into n1 and n2. When the hardware resource specifications are not sufficient to support the hardware implementation of the affine transformation of n1 or n2, further segmentation can be performed based on n1 and n2.

[0173] For example, when the hardware platform can only implement affine transformations of 64 points or less, for the affine transformation of n=65536, it can be first decomposed into 1024 64-point affine transformations and 64 1024-point affine transformations in a 64x1024 manner. The former can be performed directly, and each 1024-point affine transformation in the latter is further decomposed into 64x16 according to Algorithm 5 using 1024 as the n value, that is, each 1024-point affine transformation is further decomposed into 64 16-point affine transformations and 16 64-point affine transformations.

[0174] In this recursive decomposition method, it is theoretically possible to implement affine transformation functions of arbitrary length by multiplexing small-length affine transformation unit modules (with dimension switching), thereby alleviating the limitations of hardware platform resource specifications.

[0175] Next, we will first introduce the principle correctness of Algorithm 5, that is, the consistency between Algorithm 5 and Algorithm 1, and then introduce the specific role of Algorithm 5 in the hardware environment.

[0176] 5. The principle correctness of Algorithm 5 is proved as follows:

[0177] 1. According to step 2) in Algorithm 5, the following deduction can be made:

[0178] T2[x][y]=t1[x] / / According to step 2.4)

[0179] →T2[a1*x+b1 mod n1] [y]=t1[a1*x+b1 mod n1] / / Perform affine transformation on x on both sides of the equation

[0180] =s1[x] / / According to step 2.3)

[0181] = T1[x][y] / / According to step 2.2)

[0182] That is:

[0183] T2[a1*x+b1 mod n1][y] = T1[x][y] (4)

[0184] 2. According to step 3) in Algorithm 5, the following deduction can be made:

[0185] T3[x][y]=t2[y] / / According to step 3.4)

[0186] →T3[x][a2*y+b2 mod n2]= t2[a2*y+b2 mod n2] / / Perform affine transformation on y on both sides of the equation

[0187] = s2[y] / / According to step 3.3)

[0188] = T2[x][y] / / According to step 3.2), derivation ends

[0189] That is:

[0190] T3[x][a2*y+b2 mod n2]=T2[x][y] (5)

[0191] 3. Based on the above derived formulas (4) and (5), we can continue to deduce as follows:

[0192] T3[x][a2*y+b2 mod n2]=T2[x][y] / / This is formula (5)

[0193] →T3[a1*x+b1 mod n1][a2*y+b2 mod n2]= T2[a1*x+b1 mod n1][y]

[0194] / / Perform affine transformation on x on both sides of the equation

[0195] = T1[x][y] / / According to formula (4)

[0196] That is:

[0197] T3[a1*x+b1 mod n1][a2*y+b2 mod n2]= T1[x][y] (6)

[0198] 4. Based on the formula (6) derived above, and steps 1) and 4) in Algorithm 5, the following derivation can be continued:

[0199] D[x*n2+y] = T3[x][y] / / According to step 4)

[0200] →D[(a1*x+b1 mod n1)*n2+(a2*y+b2 mod n2)]=T3[a1*x+b1 mod n1][a2*y+b2mod n2]

[0201] / / Perform affine transformation on both sides of the equation

[0202] = T1[x][y] / / According to formula (6)

[0203] =S[x*n2+y] / / According to step 1)

[0204] That is:

[0205] D[(a1*x+b1 mod n1)*n2+(a2*y+b2 mod n2)]= S[x*n2+y] (7)

[0206] 5. According to the calculation formulas of a1, b1, a2 and b2 in Algorithm 5, the index expression on the left side of Formula (7) can be derived as follows:

[0207] (a1*x+b1 mod n1)*n2+ (a2*y+b2 mod n2)

[0208] = ((a1*x+b1 mod n1)*n2+ (a2*y+b2 mod n2)) mod n

[0209] / / Because (a1*x+b1 mod n1)*n2+(a2*y+b2 mod n2)≤(n1-1)*n2+ (n2-1)=n1*n2-1<n

[0210] = ((a*x+b1 mod n1)*n2+ (a2*y+b2 mod n2)) mod n / / According to the calculation formula of a1 in step 2.1)

[0211] = ((a*x+b1 mod n1)*n2+ (a*y+b mod n2)) mod n / / According to the calculation formula of a2 and b2 in step 3.1)

[0212] = (a*x*n2+b1*n2+(a*y+b mod n2)) mod n

[0213] / / Using the properties of modular operation: if n=n1*n2, for any number c, (c mod n1)*n2=c*n2 mod n

[0214] = (a*x*n2+a*y+b) mod n

[0215] / / Let G = a*y+b mod n. According to step 2.1), b1 = floordiv(G,n2) mod n1 = G / n2- (Gmod n2) mod n1. Combined with n = n1*n2, we get G = b1*n2+(G mod n2). That is, a*y+b mod n = b1*n2+(a*y+b mod n2).

[0216] = a*(x*n2+y)+b mod n / / simple transformation

[0217] That is:

[0218] (a1*x+b1 mod n1)*n2+ (a2*y+b2 mod n2)= a*(x*n2+y)+b mod n (8)

[0219] Substituting equation (8) into equation (7), we can obtain: D[a*(x*n2+y)+b mod n]=S[x*n2+y], and then replacing x*n2+y on both sides of the equation with i, we can obtain: D[a*i+b mod n]=S[i].

[0220] This proves that the input and output of Algorithm 5 are the same as those of Algorithm 1, and the idea of ​​recursive decomposition in Algorithm 5 is correct. Next, we will introduce how Algorithm 5 plays its specific role in the hardware environment.

[0221] 6. How Algorithm 5 works in a hardware environment

[0222] In privacy computing such as fully homomorphic encryption, the length n of the polynomial data may be very large. At this time, in the hardware environment, it is often necessary to store several different coefficients in the same polynomial in different address bits in the same memory. For example, a polynomial data of length 65536 may be divided into 256 fragments of length 256, and then stored in 256 memories, each storing 256 coefficients. In this storage method, the essence of the affine transformation is equivalent to reading any of the polynomial coefficients from a certain address of a certain memory and writing it to another address of another memory. It should be understood that the following mainly uses the memory as a random access memory (RAM) as an example for relevant explanation, but other types of memory can also be used.

[0223] Figure 7 Shown Figure 1 A possible storage format of the polynomial data in hardware. Specifically, the 16 coefficients are stored in 4 RAMs, with 4 coefficients stored in each RAM. It also shows the changes in the data in the RAM after performing an affine transformation.

[0224] The following first analyzes two aspects that can be optimized in hardware implementation when performing affine transformation according to Algorithm 1; then introduces how Algorithm 5 achieves optimization in these two aspects.

[0225] Specifically, a major difficulty in hardware implementation of affine transformation is that, although the "where each coefficient comes from and where it goes" is clearly defined by the calculation steps of Algorithm 1, the flow of data in hardware needs to follow a major limitation: in the same clock cycle, dual-port RAM can generally only read out one number and write back one number. This leads to, Figure 7 Although the read and write positions of the 16 point data in the image do not overlap with each other according to the mathematical algorithm and can be done at the same time, in hardware implementation, due to the limitation of RAM, only 4 data read operations and 4 data write operations can be performed in a single clock, that is, 4 read and write operations are required to complete the affine transformation movement of all data. Figure 8 A specific group reading and writing example is given.

[0226] Combination Figure 7 and Figure 8 Observation and analysis show that according to the logic of Algorithm 1 Figure 7 When the data is moved in the process, if the addresses of the four read data are the same in each read operation, the corresponding four write addresses will be different (such as Figure 8As shown in the figure, on the contrary, if the four write addresses are the same during each write operation, the corresponding read address operations will be different from each other. This means that the generation of the read and write address sequence of the RAM requires a separate address sequence control unit for each RAM. For example, when there are 256 RAMs, 256 independent address control units are required, which will cause a large logic resource control overhead. In addition, there is another problem in the logical implementation of Algorithm 1: the input and output RAMs of the data cannot be the same, that is, the original address operation cannot be performed.

[0227] However, if we follow the method of Algorithm 5 in this solution, we can effectively solve the above two problems.

[0228] Next, combine Fig. 9 , Fig.10 and Fig.11 , introduces the process of executing Algorithm 5 through the hardware platform.

[0229] like Fig. 9 As shown, the hardware platform includes a dimension switching module 91, a hardware module 92, a control unit 93, a memory 94 and an address generation unit 95 (or an address sequence generation unit 95). It should be understood that the hardware module 92 is the hardware module designed for Algorithm 1. Fig. 9 The figure only illustrates the connection relationship between the control unit 93 and other modules, which is used to indicate that other modules can perform corresponding operations according to the control signal sent by the control unit 93. In fact, other modules can also be directly connected as needed.

[0230] Fig.10 The method flow for performing polynomial coefficient rearrangement in privacy computing through a hardware platform is shown in the figure, wherein the method flow includes the following steps:

[0231] Step S1010: Perform a first conversion on the one-dimensional array formed by the n polynomial coefficients in the polynomial data S through the dimension switching module 91 to obtain a two-dimensional n1*n2 array.

[0232] It should be noted that the "first" in "the first conversion" and similar terms such as "first" and "second" elsewhere in the text are intended to distinguish similar things and do not have other limiting functions such as sorting.

[0233] The first conversion may include: the element in the i-th row and j-th column of the n1*n2 array is assigned the value of the i*n2+j-th element in the one-dimensional array. For this, please refer to calculation step 1) in Algorithm 5.

[0234] Exemplarily, the first conversion may be Fig.11 The first dimension switch in .

[0235] It should be noted that the dimension switching operations implemented by the dimension switching module 91, including the first conversion, and the second conversion and the third conversion described later, are equivalent to transposing the two-dimensional data, but this operation is only related to n, and the design is relatively simple in hardware implementation, and can be implemented using existing technologies, which will not be expanded here.

[0236] From the above, we can get a two-dimensional n1*n2 array.

[0237] Step S1020, for the n2 coefficients corresponding to each row in the n1*n2 array, based on the n2 coefficients and the first affine transformation parameters, a first call is made to the hardware module 92 to obtain the rearranged n2 coefficients to form the rearranged n1*n2 array.

[0238] To help understanding, this step is introduced from the perspective of algorithm operation and hardware implementation.

[0239] 1) Algorithm operations involved in this step:

[0240] ① For the acquisition of the n2 coefficients corresponding to the above rows, please refer to the calculation step 2.2 in Algorithm 5).

[0241] ② The above-mentioned first affine transformation parameters can be determined based on the following steps: based on the affine transformation parameters a and b configured for the polynomial data S, use the scaling factor a therein to perform a modulo operation on n1 to obtain the first scaling factor a1, and use the scaling factor a and the offset parameter b therein to perform an affine transformation on the row number y of the current row, and then adjust it according to n1 and n2 to obtain the first offset parameter b1. For this, please also refer to the calculation step 2.1 in Algorithm 5).

[0242] ③ The calculation that occurs in the first call above can be found in step 2.3 of Algorithm 5).

[0243] ④ The formation of the above rearranged n1*n2 array can be found in calculation step 2.4 in the algorithm).

[0244] For example, the execution effect of the algorithm operation in this step can be seen in Fig.11 Shown in the upper middle is a 4*4 array before and after the pipeline enters the affine transformation hardware module with a length of 4.

[0245] 2) Hardware implementation involved in this step:

[0246] ① For example, the n2 coefficients passed in the first call can be read from the same first address by the n2 memories 94 in the hardware platform, and the rearranged n2 coefficients can be written to the same second address by the n2 memories. In this way, the n2 coefficients of a single read operation and a single write operation are respectively from the same address in the n2 memories, which means that only one address generation unit 95 is needed in the hardware platform for all memories to use together, saving a lot of logic resource consumption.

[0247] Furthermore, the first address and the second address may be the same, so Algorithm 5 supports original address operations.

[0248] For the read and write operations of n2 coefficients occurring before and after the first call, see Fig.11 2 is a process of reading polynomial data T1 and writing polynomial data T2 as shown in FIG.

[0249] ② Exemplarily, the determination of the first affine transformation parameters may be performed by the control unit 93 .

[0250] From the above, we can get the rearranged n1*n2 array.

[0251] Step S1030: Perform a second conversion on the rearranged n1*n2 array through the dimension switching module 91 to obtain an n2*n1 array.

[0252] The second conversion is equivalent to transposing the n1*n2 array, specifically including: assigning the i-th row and j-th column element in the n1*n2 array to the j-th row and i-th column element in the n2*n1 array. For this, see also calculation step 3.2 in Algorithm 5).

[0253] For example, the effect of the second conversion can also be seen in Fig.11 The second dimension switching shown in .

[0254] From the above, we can get a two-dimensional n2*n1 array.

[0255] Step S1040, for the n1 coefficients corresponding to each row in the n2*n1 array, a second call is made to the hardware module 92 based on the n1 coefficients and the second affine transformation parameter to obtain the rearranged n1 coefficients to form a rearranged n2*n1 array.

[0256] To help understanding, this step is introduced from the perspective of algorithm operation and hardware implementation.

[0257] 1) Algorithm operations involved in this step:

[0258] ① For obtaining the n1 coefficients corresponding to the above rows, please refer to the calculation step 3.2 in Algorithm 5).

[0259] ② The above-mentioned second affine transformation parameters can be determined based on the following steps: Based on the affine transformation parameters a and b configured for the polynomial data S, the scaling coefficient a and the offset parameter b are used to perform a modulo operation on n2 to obtain the second scaling coefficient a2 and the second offset parameter b2. For this, please refer to the calculation step 3.1 in Algorithm 5).

[0260] ③ The calculation that occurs in the second call above can be found in calculation step 3.3 in Algorithm 5).

[0261] ④ The formation of the above rearranged n2*n1 array can be found in calculation step 3.4 in the algorithm).

[0262] For example, the execution effect of the algorithm operation in this step can be seen in Fig.11 The 4*4 array before and after the pipeline enters the affine transformation hardware module with a length of 4 is shown in the lower middle part.

[0263] 2) Hardware implementation involved in this step:

[0264] ① For example, the n1 coefficients passed in the second call can be read from the same third address by the n1 memories 94 in the hardware platform, and the rearranged n1 coefficients can be written to the same fourth address by the n1 memories. In this way, the n1 coefficients of a single read operation and a single write operation are respectively from the same address in the n1 memories, which means that only one address generation unit 95 is needed in the hardware platform for all memories to use together, saving a lot of logic resource consumption.

[0265] Furthermore, the third address and the fourth address may be the same, so Algorithm 5 supports original address operation.

[0266] For the read and write operations of n1 coefficients before and after the second call, see Fig.11 2 shows the process of reading polynomial data T2 and writing polynomial data T3.

[0267] ② Exemplarily, the determination of the second affine transformation parameters may be performed by the control unit 93 .

[0268] From the above, we can get the rearranged n2*n1 array.

[0269] Step S1050: Perform a third transformation on the rearranged n2*n1 array through the dimension switching module 91 to obtain a one-dimensional array as the rearranged n polynomial coefficients.

[0270] It should be noted that the third conversion is the inverse conversion of the first conversion. For this, please refer to calculation step 4 in Algorithm 5).

[0271] Exemplarily, the third conversion may be Fig.11 The third dimension switch in .

[0272] The above introduces the method steps of executing Algorithm 5 through the hardware platform. In the hardware environment, Algorithm 5 can save a lot of logic resource consumption and support original address operation.

[0273] It should also be noted that when truly realizing the automorphism, coefficient extraction, and first monomial multiplication of the polynomial, it is also necessary to involve the negation of some data in the modular sense. This function can be completed jointly by selecting any one of the two sets of "short" affine transformations, or after all the data is written to the output location, the negation operation in the modular sense of the local data can be performed separately.

[0274] In summary, the solutions provided in the embodiments of this specification mainly have the following improvements and produce corresponding beneficial effects:

[0275] Improvement point 1: Unify and abstract at least three different data permutation rules involved in privacy computing such as TFHE, including polynomial automorphism transformation, coefficient extraction, and first monomial multiplication, into affine transformation, thereby improving the reuse of hardware modules and simplifying the hardware architecture.

[0276] Automorphism transformation, coefficient extraction, and first monomial multiplication are three different unrelated permutation functions in the fully homomorphic scheme. If targeted hardware design is performed separately, three different hardware logic units are required. However, this scheme abstracts the three permutation rules into affine transformation, and performs hardware design for affine transformation. A set of modules with different parameter input configurations can support the three permutation functions at the same time, reducing the number of required module types, which is very helpful in simplifying the overall hardware architecture.

[0277] Improvement point 2: Make full use of the recursive characteristics of the affine transformation itself, decompose the long-length data affine transformation into multiple short-length data affine transformations and relatively fixed data dimension switching, thereby alleviating the resource specification limitations of the hardware platform environment.

[0278] In the hardware platform, when the length n of the polynomial data is too long, there is a high probability that different points in the same polynomial will be stored at different addresses of the same RAM, which makes it difficult to bear the resource consumption of reading and writing address control when performing affine transformation directly according to the original length n. This solution uses the recursive nature of the affine transformation itself to decompose n to a certain extent according to the limitations of the hardware platform specifications, and perform affine transformation at a smaller length, thereby achieving the originally expected replacement function.

[0279] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Fig.10 The method described.

[0280] According to another embodiment of the present invention, there is also provided a computing device, comprising a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, Fig.10 The method described.

[0281] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0282] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A system composed of hardware modules, wherein the hardware modules are used to perform rearrangement of polynomial coefficients in privacy computing, comprising: An input port for receiving a plurality of coefficients in polynomial data, wherein each coefficient has a corresponding index; A configuration port for receiving configured affine transformation parameters, including a scaling factor and an offset parameter; the affine transformation parameters are determined based on the type of the privacy calculation; A calculation unit, used for respectively changing the index of each coefficient to the result of performing affine transformation on the index using the affine transformation parameter, so as to obtain a plurality of rearranged coefficients; The output port is used to output the rearranged multiple coefficients.

2. The system according to claim 1, wherein: The number of the multiple coefficients is a positive integer power of 2, the scaling factor and the offset parameter are both non-negative integers less than the number, and the scaling factor is an odd number.

3. The system according to claim 1, wherein: The affine transformation parameters also include a modulus, and the value of the modulus is the number of the multiple coefficients; wherein the affine transformation includes: After scaling the indexes of the coefficients by using the scaling coefficients, performing an offset process on the scaling result by using the offset parameters; A modulo operation is performed on the result of the offset processing based on the modulus to obtain a result of affine transformation.

4. The system according to claim 1, wherein: The privacy calculation is an automorphic transformation of a polynomial, the scaling coefficient is a result of taking the modulus of the automorphic transformation constant and the number of the multiple coefficients, and the value of the offset parameter is 0.

5. The system according to claim 1, wherein: The privacy calculation is the coefficient extraction of the polynomial, the value of the scaling coefficient is the number of the multiple coefficients minus 1, and the value of the offset parameter is the extraction index.

6. The system according to claim 1, wherein: The privacy calculation is the multiplication of the first monomial of the polynomial, the value of the scaling coefficient is 1, and the value of the offset parameter is the result of taking the modulo of the difference obtained by subtracting the power of the monomial from the number of the multiple coefficients.

7. A method for performing polynomial coefficient rearrangement in privacy computing by a hardware platform, wherein the hardware platform includes a dimension switching module and a hardware module in the system as claimed in claim 1; the method comprising: By means of the dimension switching module, a first conversion is performed on the one-dimensional array formed by n polynomial coefficients in the polynomial data to obtain a two-dimensional n1*n2 array; For n2 coefficients corresponding to each row in the n1*n2 array, based on the n2 coefficients and the first affine transformation parameter, the hardware module is first called to obtain the rearranged n2 coefficients to form the rearranged n1*n2 array; By means of the dimension switching module, a second conversion is performed on the rearranged n1*n2 array to obtain an n2*n1 array; For n1 coefficients corresponding to each row in the n2*n1 array, based on the n1 coefficients and the second affine transformation parameter, a second call is made to the hardware module to obtain the rearranged n1 coefficients to form a rearranged n2*n1 array; The dimension switching module performs a third conversion on the rearranged n2*n1 array to obtain a one-dimensional array as the rearranged n polynomial coefficients.

8. The method according to claim 7, wherein: The first conversion includes: The element in the i-th row and j-th column of the n1*n2 array is assigned the value of the i*n2+j-th element in the one-dimensional array.

9. The method according to claim 8, wherein: The third conversion is an inverse conversion of the first conversion.

10. The method according to claim 7, wherein: The first affine transformation parameters are determined by a control unit in the hardware platform based on the following steps: Based on the affine transformation parameters configured for the polynomial data, a modulo operation is performed on n1 using the scaling coefficient therein to obtain a first scaling coefficient, and an affine transformation is performed on the row number of the current row using the scaling coefficient and the offset parameter therein, and then adjusted according to n1 and n2 to obtain a first offset parameter.

11. The method according to claim 7, wherein: The second affine transformation parameters are determined by a control unit in the hardware platform based on the following steps: Based on the affine transformation parameters configured for the polynomial data, a modulo operation is performed on n2 using the scaling coefficient and the offset parameter therein to obtain a second scaling coefficient and a second offset parameter.

12. The method according to claim 7, wherein: The n2 coefficients passed in the first call are read from the same first address by the n2 memories in the hardware platform, and the rearranged n2 coefficients are written to the same second address by the n2 memories; The n1 coefficients passed in the second call are read from the same third address by the n1 memories in the hardware platform, and the rearranged n1 coefficients are written into the same fourth address by the n1 memories.

13. The method according to claim 12, wherein: The first address is the same as the second address, and the third address is the same as the fourth address.

14. The method according to claim 12 or 13, wherein: The first address, the second address, the third address and the fourth address are generated by an address generation unit in the hardware platform.

15. The method according to claim 12, wherein: The memory in the hardware platform is a read-write dual-port memory.

Images